Privacy Policy

1. Scope and Data Controller

This Privacy Policy applies to all digital products and services operated by Xiping Canxin New Energy Technology Co., Ltd, a company registered in China with its principal place of business at No. 26, Group 8, Fenglaozhuang Village Committee, Caizhai Hui Ethnic Township, Xiping County, 463900, People's Republic of China.

This Policy covers:

• Our website at canxinnew.com and all subdomains;
• Our mobile application(s) available on Google Play and the Apple App Store;
• Any IoT management platform or portal we operate;
• Business inquiry, support, and newsletter communications;
• Any other online service that links to this Policy.

For users located in the European Economic Area (EEA) and the United Kingdom, Canxin acts as the data controller as defined under GDPR and UK GDPR. For activities conducted by third-party service providers and advertising networks, those parties are independent controllers or processors as applicable and governed by their own privacy policies.

2. Information We Collect

2.1 Information You Provide Directly

• Contact form data: Full name, company name, email address, phone number, country, message content, and inquiry type submitted through our website contact form.
• Account registration: Email address, username, password (stored as a one-way hash), and profile preferences when you create an account in our mobile application.
• Business inquiries: Information provided in emails or messages sent to support@canxinnew.com or wangzhongxing@canxinnew.com.
• Newsletter subscription: Email address and subscription preferences.
• Enterprise contracts: Business registration information, billing address, payment method details (handled by our payment processors, not stored on our servers), and authorized contact personnel information.

2.2 Information Collected Automatically

• Device identifiers: Advertising ID (GAID/IDFA), device manufacturer, model, operating system version, platform (Android/iOS), screen resolution, and language settings.
• App usage data: Features accessed, energy dashboard interactions, IoT device pairing actions, session duration, crash reports, app version, and in-app event sequences.
• Log and analytics data: IP address (truncated after processing), browser/user-agent string, referring URL, pages visited, time and date of access, and session duration on our website.
• Location data: Approximate geographic location derived from IP address for analytics and compliance purposes. If you install a photovoltaic monitoring IoT device linked to the app, the device location (GPS coordinates) you explicitly provide is stored to display your site on maps.
• Energy system telemetry: Output metrics (kWh generated/consumed/stored), fault and alarm status, sensor readings, and inverter/battery parameters transmitted from your IoT devices to our platform.

2.3 Information from Third Parties

• Advertising networks: Ad impression events, click data, and attribution signals from advertising SDKs integrated into our mobile application (see Section 5).
• Analytics providers: Aggregated and anonymized behavioral metrics from Firebase Analytics, Google Analytics, or similar services.
• App stores: Install referrer information, crash reports, and review data provided by Google Play and the Apple App Store in accordance with their developer agreements.

3. How We Use Your Information

We use personal information for the following purposes and legal bases:

Purpose	Legal Basis (GDPR)
Providing and maintaining our services	Contract performance (Art. 6(1)(b))
Responding to contact form inquiries	Legitimate interests / Pre-contractual (Art. 6(1)(b)(f))
Processing enterprise account setup	Contract performance (Art. 6(1)(b))
Sending newsletters and marketing	Consent (Art. 6(1)(a)) — opt-in required
Analytics and product improvement	Legitimate interests (Art. 6(1)(f))
Personalised and interest-based advertising	Consent (Art. 6(1)(a)) — IAB TCF / ATT required
Fraud detection and security	Legitimate interests (Art. 6(1)(f))
Legal compliance and record-keeping	Legal obligation (Art. 6(1)(c))
IoT device telemetry processing	Contract performance (Art. 6(1)(b))

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects without your explicit consent.

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We share information only in the following circumstances:

4.1 Service Providers

We engage trusted service providers to assist in operating our services, subject to strict data processing agreements (DPAs) that prohibit them from using your data for any purpose other than providing services to us. These include cloud infrastructure providers, email delivery services, analytics platforms, and customer support tools.

4.2 Advertising Technology Partners

Our mobile application integrates advertising SDKs from the third-party advertising networks listed in Section 5. These SDKs may collect device identifiers, IP addresses, and behavioral signals to deliver contextual or interest-based advertisements. Please see Section 5 for details of each partner and their opt-out mechanisms.

4.3 App Distribution Platforms

Google (via Google Play) and Apple (via the App Store) receive data as part of normal app distribution, update delivery, crash reporting, and subscription management. This is governed by their respective developer program agreements and privacy policies.

4.4 Business Transfers

In the event of a merger, acquisition, financing, restructuring, or sale of all or part of our assets, your personal information may be transferred as part of the transaction. We will notify you via prominent notice on our website or by email before your data is transferred and becomes subject to a different privacy policy.

4.5 Legal Requirements

We may disclose your information if required to do so by law, court order, governmental regulation, or legal process, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of Canxin, our users, or the public.

4.6 Aggregated and Anonymized Data

We may share aggregated, de-identified, or anonymized data — such as aggregate energy generation statistics — with partners, investors, or the public. Such data cannot be reasonably used to identify any individual.

5. Third-Party SDKs and Advertising Networks

Our mobile application (available on Google Play and the Apple App Store) integrates software development kits (SDKs) from third-party advertising and analytics companies to deliver advertisements and measure app performance. These SDKs operate under their own privacy policies. The following is a complete list of integrated advertising and analytics SDKs:

5.1 Google AdMob (Google LLC)

Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Privacy Policy: policies.google.com/privacy
Opt-Out / Ad Settings: adssettings.google.com | Google Play: Settings > Google > Ads > Reset Advertising ID or Opt Out of Personalization
Data Collected: Google Advertising ID (GAID), device ID, IP address, app usage events, location (if permission granted), browser cookies, and interest category signals.
Purpose: Delivery of banner, interstitial, rewarded video, and native advertisements; ad frequency capping; fraud detection; conversion measurement; audience segmentation.
AdMob Policies: We comply with Google AdMob's Publisher Policies, including prohibitions on click fraud, invalid traffic, inappropriate content adjacent to ads, and misrepresentation. We implement Google's EU User Consent Policy (EUCP) via a certified CMP for EEA/UK users. We use AdMob's Restricted Data Processing (RDP) feature for California users where required under CCPA.

5.2 Meta Audience Network (Meta Platforms, Inc.)

Provider: Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA.
Privacy Policy: facebook.com/privacy/policy/
Opt-Out: Facebook Ad Preferences | DAA opt-out at optout.aboutads.info
Data Collected: Mobile Advertising ID, hashed device identifiers, app events, ad interaction events, and demographic signals.
Purpose: Delivery of interest-based banner, interstitial, native, and rewarded video ads; app install attribution; lookalike audience creation.
Compliance: We comply with Meta's Audience Network Policies, including restrictions on sensitive data categories, prohibited content, and the requirement to present Meta's Data Use Checkup disclosures where required.

5.3 AppLovin / AppLovin MAX (AppLovin Corporation)

Provider: AppLovin Corporation, 1100 Page Mill Road, Palo Alto, CA 94304, USA.
Privacy Policy: applovin.com/privacy/
Opt-Out: AppLovin provides an opt-out at applovin.com/optout/
Data Collected: Advertising ID, IP address, device information, app usage signals, and auction-related metadata through the MAX mediation platform.
Purpose: Ad mediation, real-time bidding (RTB), fill optimization across multiple ad networks, and performance analytics.
Note: AppLovin MAX mediates multiple demand sources simultaneously. All mediated partner SDKs are subject to their own privacy policies. We have reviewed and accepted AppLovin's publisher terms, which require GDPR and CCPA compliance mechanisms.

5.4 Unity Ads (Unity Technologies)

Provider: Unity Technologies, 30 3rd Street, San Francisco, CA 94103, USA.
Privacy Policy: unity.com/legal/privacy-policy
Opt-Out: Via Unity Ads dashboard or device-level ad ID opt-out.
Data Collected: Advertising ID, session data, app event data, game performance metadata, and in-app purchase signals.
Purpose: Delivery of rewarded video and interstitial advertisements; in-app purchase attribution; user engagement analytics.
Compliance: We comply with Unity's Publisher Policies and Data Processing Agreement, including GDPR consent requirements. Unity's Audience Pinpointing opt-out is surfaced to EEA users via our CMP.

5.5 IronSource / Supersonic (IronSource Ltd., now part of Unity)

Provider: IronSource Ltd. (merged with Unity Technologies), Tel Aviv, Israel.
Privacy Policy: is.com/privacy-policy/
Opt-Out: Via IronSource privacy opt-out portal or app-level advertising ID opt-out.
Data Collected: Advertising ID, device fingerprint signals (for fraud prevention only), IP address, app event signals, and rewarded ad completion events.
Purpose: Delivery of rewarded video, offerwall, and interstitial advertisements; mediation; user acquisition analytics.
Compliance: We comply with IronSource Publisher Policies. For EEA users, IronSource operates under Standard Contractual Clauses (SCCs) for data transfers outside the EEA.

5.6 Vungle / Liftoff (Liftoff Mobile, Inc.)

Provider: Liftoff Mobile, Inc. (formerly Vungle, Inc.), 900 Middlefield Road, Redwood City, CA 94063, USA.
Privacy Policy: liftoff.io/privacy-policy/
Opt-Out: Liftoff Privacy Opt-Out
Data Collected: Advertising ID, device type, OS version, app version, IP address, and ad interaction data.
Purpose: Delivery of video interstitial and rewarded video advertisements; user acquisition; retargeting.
Compliance: Liftoff is GDPR and CCPA compliant. We pass consent signals via the IAB TCF 2.0 framework.

5.7 InMobi (InMobi Pte. Ltd.)

Provider: InMobi Pte. Ltd., 30 Cecil Street, #19-08, Prudential Tower, Singapore 049712.
Privacy Policy: inmobi.com/privacy-policy/
Opt-Out: inmobi.com/page/opt-out/
Data Collected: Device ID, IP address, location (coarse), app context, and behavioral signals for ad targeting.
Purpose: Delivery of mobile banner, interstitial, and video advertisements across global markets including Asia-Pacific, Europe, and North America.
Compliance: InMobi complies with GDPR, CCPA, COPPA, Australia's Privacy Act, and Singapore's PDPA. We pass consent signals through InMobi's consent API.

5.8 Mintegral (Mobvista / Mintegral International Limited)

Provider: Mintegral International Limited, a subsidiary of Mobvista Inc., with offices in Hong Kong and Singapore.
Privacy Policy: mintegral.com/en/privacy/
Opt-Out: Via app-level advertising ID opt-out or Mintegral privacy contact.
Data Collected: Advertising ID, device attributes, IP address, app usage signals, creative interaction data, and post-install event attribution data.
Purpose: Programmatic delivery of interactive video, playable, and rewarded video advertisements; user acquisition; attribution.
Compliance: Mintegral complies with GDPR, CCPA, PIPL (China), PDPA (Singapore), and Australia's Privacy Act. All data transfers from the EEA use SCCs.

5.9 Pangle — TikTok for Business (Bytedance Ltd.)

Provider: Bytedance Ltd. / TikTok for Business (Pangle), Singapore and global offices.
Privacy Policy: pangleglobal.com/privacy/enduser-en
Opt-Out: Device advertising ID opt-out or Pangle privacy contact form.
Data Collected: Advertising ID, device identifier, IP address, app event data, video ad interaction data, and click attribution signals.
Purpose: Delivery of video, rewarded, interstitial, and native advertisements; user acquisition analytics; lookalike audience modeling.
Compliance: Pangle complies with GDPR (via SCCs), CCPA, PIPL, and PDPA. Consent is obtained through our CMP before enabling personalized Pangle ads for EEA/UK users.

5.10 Chartboost (Chartboost, Inc., a Zynga company)

Provider: Chartboost, Inc., a subsidiary of Zynga Inc., 699 8th Street, San Francisco, CA 94103, USA.
Privacy Policy: chartboost.com/legal/privacy-policy/
Opt-Out: Via device-level ad ID opt-out or Chartboost privacy contact.
Data Collected: Device ID, advertising ID, app context, and behavioral interaction signals.
Purpose: Delivery of interstitial, rewarded, and playable advertisements; direct deal marketplace participation.
Compliance: Chartboost complies with GDPR, CCPA, and COPPA. We pass IAB TCF 2.0 consent strings to Chartboost's consent API.

5.11 Digital Turbine / AdColony (Digital Turbine, Inc.)

Provider: Digital Turbine, Inc. (formerly AdColony), 6701 W Parmer Lane, Austin, TX 78729, USA.
Privacy Policy: digitalturbine.com/privacy-policy/
Opt-Out: Digital Turbine Opt-Out
Data Collected: Advertising ID, device attributes, IP address, and high-definition video ad interaction events.
Purpose: Delivery of high-definition video interstitial and rewarded video advertisements; value exchange advertising.
Compliance: Digital Turbine is GDPR compliant and a member of the Network Advertising Initiative (NAI) and Digital Advertising Alliance (DAA).

5.12 Tapjoy (Tapjoy, Inc., an IronSource company)

Provider: Tapjoy, Inc. (part of IronSource/Unity), San Francisco, CA, USA.
Privacy Policy: tapjoy.com/legal/#privacy-policy
Opt-Out: Via Tapjoy opt-out URL embedded in in-app offerwall disclosures.
Data Collected: Advertising ID, IP address, in-app event completions, and offer interaction data.
Purpose: Offerwall and rewarded engagement advertisements where users earn virtual currency or content for completing advertiser offers.
Compliance: Tapjoy complies with GDPR and CCPA. Offerwall disclosures include direct links to privacy opt-out mechanisms.

5.13 Fyber (Digital Turbine / Fyber N.V.)

Provider: Fyber N.V. (acquired by Digital Turbine), Berlin, Germany.
Privacy Policy: fyber.com/privacy-policy/
Data Collected: Advertising ID, device data, IP address, and bidstream signals through the Fyber FairBid mediation platform.
Purpose: Mediated header bidding, rewarded video, and interstitial ad delivery.

5.14 Smaato (Smaato, Inc.)

Provider: Smaato, Inc., 270 Lafayette Street, Suite 702, New York, NY 10012, USA.
Privacy Policy: smaato.com/privacy/
Data Collected: Advertising ID, device type, IP address, and standard OpenRTB bid-request signals.
Purpose: Programmatic real-time bidding demand for banner and interstitial ad inventory.

5.15 Google Firebase Analytics & Crashlytics

Provider: Google LLC.
Privacy Policy: firebase.google.com/support/privacy
Data Collected: Anonymous user IDs, app event sequences, session duration, crash stack traces, device attributes, and OS version.
Purpose: App performance monitoring, crash reporting, funnel analysis, and A/B testing. Data is used in aggregate form and does not personally identify you.
Opt-Out: You may disable Firebase Analytics data collection by enabling "Disable Analytics Data Collection" in the app Settings menu.

6. Advertising Formats and Practices

Our mobile application displays advertisements to support free access to core features. We use the following ad formats:

6.1 Banner Advertisements

Static or animated rectangular advertisements displayed at the top or bottom of app screens. Banner ads may appear contextually or in a personalized manner based on your advertising preferences. They do not interrupt app use. You may close or minimize banner ads where the dismiss control is visible.

6.2 Interstitial / Splash Advertisements

Full-screen advertisements that appear at natural transition points in the app, such as between screens or at app launch ("splash ads"). Interstitial ads display a visible close button (typically after 5 seconds) and must not appear during active user interaction with core functions. We comply with Google AdMob's interstitial placement policies, including prohibition of accidental clicks and frequency capping requirements.

6.3 Rewarded Video Advertisements

Optional full-screen video advertisements that users voluntarily choose to watch in exchange for an in-app reward (such as extended monitoring access, premium features, or virtual items). Rewarded ads are always opt-in. You are never required to watch a rewarded ad to access core functionality. The opt-in is shown with a clear description of the reward and a "No Thanks" option. Video ads include a skip option after a required minimum viewing period (typically 5–30 seconds as set by the advertiser).

6.4 Native Advertisements

Advertisements styled to match the look and feel of surrounding app content. All native ads are clearly labeled with a visible "Ad", "Sponsored", or "Advertisement" label as required by applicable platform policies and advertising standards. Native ad labels comply with Google Play's and Apple App Store's transparency requirements.

6.5 Advertising Targeting and Personalization

With your consent (or where permitted by applicable law), ads may be targeted based on interests inferred from your device activity across other apps and websites. Without your consent (or upon opt-out), only contextual advertisements — based on the current app context, not your profile — will be displayed. To change your ad personalization preferences, navigate to: App Menu > Settings > Privacy > Ad Preferences.

6.6 Frequency Capping

We apply frequency caps to prevent excessive ad repetition. Interstitial ads are capped at no more than once per 60 seconds and no more than three times per session. Splash/startup ads are shown no more than once every 24 hours per device.

6.7 Children and Advertising

Our app is rated for users aged 13 and above. We do not serve behavioral or interest-based advertisements to users identified as under 13 years of age. If our app is accessed by a child, ad networks are instructed to serve only non-personalized, contextual advertisements. Relevant ad network child-directed treatment flags (e.g., AdMob's tagForChildDirectedTreatment, tagForUnderAgeOfConsent) are set appropriately.

7. Cookies and Tracking Technologies

7.1 Website Cookies

Our website uses the following categories of cookies:

• Strictly Necessary Cookies: Required for the website to function. These include session cookies used for secure form submissions, navigation state, and user preference storage. Cannot be disabled.
• Analytics Cookies: Google Analytics 4 cookies (_ga, _gid, _gat) used to collect anonymized traffic statistics. IP addresses are anonymized before storage. These are loaded only after cookie consent is obtained in the EEA/UK.
• Preference Cookies: Remember your language, region, and cookie consent choices across visits.

You may manage cookie preferences through our cookie consent banner or your browser settings. Disabling certain cookies may impair website functionality.

7.2 Mobile App Tracking

Our mobile app does not use browser cookies. Instead, it may use:

• Advertising IDs: Google Advertising ID (GAID) on Android, Identifier for Advertisers (IDFA) on iOS — used for ad targeting and attribution, subject to your ATT/ad personalization consent.
• Firebase Installation IDs: Pseudonymous identifiers used for app analytics and crash reporting. These do not identify you personally.
• SDK-Specific Identifiers: Each ad network SDK may generate its own pseudonymous identifiers for frequency capping and fraud prevention. These are listed in each network's privacy policy (see Section 5).

8. Children's Privacy (COPPA and International Equivalents)

8.1 United States — COPPA

We comply with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. § 6501 et seq. and the FTC's COPPA Rule (16 CFR Part 312). We do not knowingly collect personal information from children under 13. If we discover that we have inadvertently collected personal information from a child under 13, we will delete it immediately. Parents or legal guardians may contact us at support@canxinnew.com to request review, deletion, or to refuse further collection of their child's information.

8.2 European Economic Area and United Kingdom

Under GDPR Article 8 and UK GDPR, processing of a child's personal data for information society services is lawful only with parental consent for children under 16 (or under 13–16 depending on Member State law). Our services are not directed at children under 16 in the EEA/UK. If consent is required and we become aware that a user is under 16, we will terminate the account and delete collected data.

8.3 Age Verification

During account registration in our mobile app, we request a date of birth. Users indicating they are under 13 (or under 16 in EEA/UK) are refused account creation. We acknowledge that age gates are not foolproof; parents who discover their child has misrepresented their age should contact us immediately.

8.4 Google Play Families Policy

Our app is not classified under Google Play's Families Policy. If we publish a separate app designed for children, that app will comply with Google Play's Families Policy requirements, including restrictions on ad network SDKs, data collection, and in-app purchases.

8.5 Apple App Store Age Rating

Our app carries an age rating consistent with its content. The app is not rated 4+ (designed for children) and therefore is not subject to Apple's additional restrictions on data collection from children under 13 for child-directed apps. However, we voluntarily apply COPPA-compliant practices globally.

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law:

• Contact form submissions: Retained for 3 years from the date of submission, or until the matter is fully resolved, whichever is later.
• Account data: Retained for the duration of the account plus 2 years after account deletion, unless longer retention is required by law or legitimate interest.
• IoT telemetry data: Raw sensor readings are retained for 13 months. Aggregated monthly energy reports are retained for 7 years for warranty and performance analysis purposes.
• Transaction/billing records: Retained for 7 years as required by applicable financial and tax regulations.
• Newsletter subscriptions: Retained until you unsubscribe, plus 12 months for suppression list purposes.
• Analytics data: Anonymized and aggregated after 14 months; raw session data is deleted at 26 months (Google Analytics default).
• Crash reports: Firebase Crashlytics retains crash data for 90 days.
• Legal hold data: Where data must be preserved for active litigation, regulatory investigation, or legal obligation, it is retained until the hold is lifted.

Upon expiration of the applicable retention period, personal data is securely deleted or anonymized. You may request early deletion subject to the exceptions described in Section 11 (Right to Erasure).

10. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction:

• Encryption in transit: All data transmitted between your device and our servers uses TLS 1.2 or higher (HTTPS). App-to-server API calls use certificate pinning.
• Encryption at rest: Sensitive data stored in our databases is encrypted at rest using AES-256.
• Access controls: Access to personal data is restricted to authorized personnel on a need-to-know basis. Administrative access requires multi-factor authentication (MFA).
• Penetration testing: We conduct periodic security assessments and penetration tests on our web and app infrastructure.
• Vendor assessments: We perform security reviews of third-party service providers and require DPAs that mandate equivalent security standards.
• Incident response: We maintain a documented security incident response plan. In the event of a data breach affecting your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (as required by GDPR) and affected users without undue delay.

Despite these measures, no system is completely secure. We cannot guarantee absolute security. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at support@canxinnew.com.

11. EU and UK General Data Protection Regulation (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under GDPR (Regulation (EU) 2016/679) and UK GDPR (retained EU law as defined in the European Union (Withdrawal) Act 2018):

• Right of Access (Art. 15): You may request a copy of the personal data we hold about you, including information about how it is processed and with whom it is shared.
• Right to Rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.
• Right to Erasure / "Right to Be Forgotten" (Art. 17): You may request deletion of your personal data where it is no longer necessary, where consent is withdrawn, or where processing is unlawful. Exceptions apply where retention is required by law or legitimate interest.
• Right to Restrict Processing (Art. 18): You may request that we restrict processing of your data in certain circumstances, such as while a rectification request is pending.
• Right to Data Portability (Art. 20): Where processing is based on consent or contract and is carried out by automated means, you may receive your data in a structured, commonly used, machine-readable format (e.g., JSON or CSV) and have it transmitted to another controller.
• Right to Object (Art. 21): You may object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.
• Rights Related to Automated Decision-Making (Art. 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. We do not currently employ such decision-making processes.
• Right to Withdraw Consent (Art. 7(3)): Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, submit a request to support@canxinnew.com with the subject line "GDPR Data Subject Request". We will respond within 30 days (extendable by a further 60 days for complex requests, with notice). We may request identity verification before fulfilling your request.

You have the right to lodge a complaint with your local supervisory authority. For the EEA, this is your national data protection authority (e.g., the German BfDI, the French CNIL, the Irish DPC). For the UK, this is the Information Commissioner's Office (ICO) at ico.org.uk. For China, it is the Cyberspace Administration of China (CAC). We would, however, appreciate the opportunity to address your concerns before you approach the supervisory authority.

11.1 Legal Bases Summary

Our primary legal bases under GDPR are: consent (Art. 6(1)(a)); contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)); and legitimate interests (Art. 6(1)(f)). For special category data, we rely on explicit consent (Art. 9(2)(a)) where applicable, though we do not knowingly collect special category data.

12. California Privacy Rights (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), grants you the following rights:

• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected, the categories of sources, the business or commercial purpose for collection, and the categories of third parties with whom we share it.
• Right to Delete: You may request deletion of personal information we have collected from you, subject to exceptions (e.g., completing transactions, security, legal obligations, or internal uses reasonably aligned with your relationship with us).
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Opt-Out of Sale or Sharing: We do not "sell" personal information as traditionally defined. However, our use of advertising SDK identifiers and cross-context behavioral advertising may constitute "sharing" under the CPRA. You may opt out via the "Do Not Sell or Share My Personal Information" link in the app's Settings > Privacy menu, or by broadcasting a Global Privacy Control (GPC) signal from your browser.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information for purposes beyond those permitted under CPRA Section 1798.121.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights by denying services, charging different prices, or providing a different level of service.

To submit a CCPA/CPRA request, email support@canxinnew.com with the subject "California Privacy Request" or use our contact form with subject "Other — California Privacy". We will respond within 45 days (extendable by 45 days with notice). We may request verification of your identity. Authorized agents may submit requests on your behalf with written authorization.

Categories of Personal Information Collected (Last 12 months): Identifiers (name, email, device ID); Internet/network activity (browsing on our website, app interactions); Geolocation data (coarse, from IP); Commercial information (purchase/subscription records); Inferences (interest categories from ad networks). No biometric, health, financial account, or precise geolocation data is collected by us directly.

13. Canada — PIPEDA and Quebec Law 25

If you are a Canadian resident, our practices comply with the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and, for Quebec residents, An Act to modernize legislative provisions as regards the protection of personal information (Law 25 / Bill 64).

Under PIPEDA, we collect, use, and disclose personal information with your knowledge and consent for identified purposes. You have the right to access your information and to challenge its accuracy. You may withdraw consent at any time, subject to legal or contractual restrictions.

Under Quebec Law 25 (effective September 2023), we provide:

• Privacy impact assessments (PIAs) for high-risk processing activities;
• A designated person responsible for the protection of personal information (our Data Protection Officer at support@canxinnew.com);
• Clear disclosure regarding automated profiling and the logic involved;
• Portability of personal information in a commonly used technological format upon request.

To exercise your rights or submit a complaint, contact support@canxinnew.com. You may also contact the Office of the Privacy Commissioner of Canada (OPC) at priv.gc.ca or the Commission d'accès à l'information (CAI) in Quebec at cai.gouv.qc.ca.

14. Brazil — Lei Geral de Proteção de Dados (LGPD)

If you are a resident of Brazil, the Lei Geral de Proteção de Dados Pessoais (LGPD, Law No. 13,709/2018) applies to our processing of your personal data.

Under the LGPD, you have the following rights (Article 18):

• Confirmation of the existence of data processing;
• Access to your personal data;
• Correction of inaccurate, incomplete, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data;
• Data portability;
• Deletion of personal data processed with your consent;
• Information on public and private entities with which we share data;
• Information on the option to not provide consent and the consequences of refusal;
• Withdrawal of consent.

Our legal bases for processing under the LGPD include: consent (Art. 7, I); contract performance (Art. 7, V); compliance with legal obligation (Art. 7, II); legitimate interests (Art. 7, IX). To exercise your LGPD rights, contact support@canxinnew.com. You may also contact Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.

15. China — Personal Information Protection Law (PIPL)

For users in the People's Republic of China, our processing is governed by the Personal Information Protection Law (PIPL, effective November 1, 2021) and associated regulations including the Data Security Law (DSL) and Cybersecurity Law (CSL).

Under PIPL, you have the right to:

• Know the rules for processing your personal information;
• Access and copy your personal information;
• Request correction or supplement of inaccurate or incomplete personal information;
• Request deletion of your personal information under specified circumstances;
• Withdraw consent;
• Object to automated decision-making and request human review;
• Data portability to designated personal information processors under conditions set by the Cyberspace Administration of China (CAC).

As a company registered in China, we: (a) appoint a personal information protection officer; (b) conduct personal information protection impact assessments (PIPIAs) for high-risk processing; (c) comply with outbound data transfer rules under PIPL Article 38, including standard contracts approved by the CAC where personal information is transferred outside China; (d) maintain processing records as required by Article 55.

To exercise your rights, contact: support@canxinnew.com. You may also complain to the Cyberspace Administration of China (CAC) at cac.gov.cn.

16. Thailand and Singapore — Personal Data Protection Acts (PDPA)

16.1 Thailand PDPA (B.E. 2562 / 2019)

For users in Thailand, the Personal Data Protection Act B.E. 2562 (PDPA) governs our data processing. Your rights include the right to access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent. We rely on consent and contractual necessity as our primary legal bases. To exercise rights under the Thailand PDPA, contact support@canxinnew.com. Complaints may be lodged with the Personal Data Protection Committee (PDPC) of Thailand.

16.2 Singapore PDPA (2012)

For users in Singapore, the Personal Data Protection Act 2012 (PDPA) and the Personal Data Protection Commission (PDPC) guidelines govern our processing. We comply with the Notification Obligation (informing you of purposes before or at the time of collection), the Consent Obligation (obtaining consent where required), the Purpose Limitation Obligation, the Data Accuracy Obligation, the Protection Obligation, and the Retention Limitation Obligation. Our Data Protection Officer is contactable at support@canxinnew.com. You may also lodge a complaint with Singapore's PDPC at pdpc.gov.sg.

17. Australia — Privacy Act 1988 and Australian Privacy Principles (APPs)

For users in Australia, our handling of personal information is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) contained in Schedule 1 of that Act.

We comply with the APPs as follows:

• APP 1 (Open and transparent management): This Policy is freely accessible and describes our personal information handling practices.
• APP 3 (Collection): We collect personal information only by lawful and fair means, and only information that is reasonably necessary for our functions.
• APP 5 (Notification): We notify you of collection and purpose at or before the time of collection.
• APP 6 (Use and disclosure): We use and disclose personal information only for the primary purpose of collection or related secondary purposes you would reasonably expect, or with your consent.
• APP 7 (Direct marketing): We do not use your personal information for direct marketing without your consent or an opt-out opportunity.
• APP 8 (Cross-border disclosure): Before disclosing personal information to overseas recipients, we take reasonable steps to ensure the recipient complies with the APPs.
• APP 12 (Access): You may request access to personal information we hold about you.
• APP 13 (Correction): You may request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading personal information.

To make an access or correction request, email support@canxinnew.com. Complaints may be made to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

18. App Store Compliance

18.1 Google Play Developer Program Policy

Our mobile application complies with all requirements of the Google Play Developer Program Policy, including:

• Data Safety Section: We have accurately completed the Google Play Data Safety Form disclosing all data types collected, sharing practices, security measures, and whether data can be deleted by users. The Data Safety summary is visible on our app's Google Play listing.
• Permissions: We request only permissions that are necessary for documented features and provide in-context rationale for each sensitive permission. We do not request permissions to use data in ways not disclosed in this Policy.
• Ads Policy: Our ads implementation complies with Google Play's Ads Policy, including restrictions on deceptive ads, ad placement requirements, and the prohibition of ads that interfere with usability.
• Families Policy: Our app is not targeted at children under 13. We have not enrolled in the Designed for Families program. If Google Play's automated systems flag our app as potentially appealing to children, we will assess and take remedial action.
• EU User Consent Policy: For users in EEA/UK, we present a certified Consent Management Platform (CMP) integrated with Google's IAB TCF 2.0 framework before serving ads, as required by Google's EU User Consent Policy.
• Financial Features Policy: Our app does not offer real-money gambling, cryptocurrency investment services, or unauthorized financial services.
• Subscriptions: Any subscription pricing, billing cycles, trial periods, and cancellation instructions are clearly disclosed in the app and on our Google Play listing, in compliance with Google Play's Subscriptions and In-App Purchases policy.

18.2 Apple App Store Review Guidelines

Our mobile application complies with all requirements of the Apple App Store Review Guidelines, including:

• App Tracking Transparency (ATT): On iOS 14.5+, we request ATT permission before accessing the IDFA or tracking users across apps/websites. Our ATT usage description clearly explains the benefit to users. If ATT permission is denied, we serve only non-personalized ads.
• Privacy Nutrition Labels: We have accurately completed Apple's Privacy Nutrition Labels in App Store Connect, disclosing data linked to the user, data used to track the user, and data not linked to the user, for all data collected by our app and all integrated SDKs.
• Required Reason APIs: We use Apple's required reason APIs only for the declared purposes and disclose these uses in our privacy manifest file (PrivacyInfo.xcprivacy).
• Privacy Manifest and Signatures: Third-party SDKs integrated in our app that appear on Apple's list of SDKs with required reasons include their privacy manifests. We have verified that these SDKs are signed and that their declared data practices are reflected in our App Store privacy labels.
• Children's Privacy (Kids Category): Our app is not in the Kids Category. If published in the Kids Category in the future, we will comply with Apple's strict requirements including prohibition of behavioral advertising, limits on data collection, and parental consent requirements.
• In-App Purchases: All premium features and subscriptions are offered through Apple's in-app purchase system. Pricing and subscription terms are disclosed before purchase, with clear cancellation instructions as required by Apple's guidelines.
• Sign In With Apple: If we offer social login options, Sign In With Apple is offered as an equivalent option for iOS users.

19. International Data Transfers

We are headquartered in China and use service providers and advertising partners located in the United States, European Union, Singapore, and other countries. When your personal information is transferred internationally, we use the following safeguards:

• EEA/UK to Third Countries: Transfers from the EEA or UK to countries without an adequacy decision (including China and the United States) are protected by Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914) or the UK International Data Transfer Agreement (IDTA), as applicable.
• China Cross-Border Transfers: Transfers of personal information outside China comply with PIPL Article 38, which requires either (a) passing a security assessment organized by the CAC (for large-scale transfers), (b) certification by a specialized institution, or (c) execution of standard contracts issued by the CAC.
• Adequacy Decisions: Where transfers are to countries covered by an EU adequacy decision (e.g., UK, Japan, South Korea, New Zealand, Canada (commercial organizations)), we rely on the adequacy decision as the transfer mechanism.
• Binding Corporate Rules: We may implement Binding Corporate Rules (BCRs) as an intra-group transfer mechanism as our operations expand.

You may obtain a copy of applicable transfer safeguards by contacting support@canxinnew.com.

20. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, legal requirements, or for other operational reasons. We will notify you of material changes by:

• Posting the updated Policy on this page with a revised "Last Updated" date;
• Displaying a prominent notice on our website or in the app for 30 days following the update;
• Sending an email notification to registered users for significant changes affecting their rights.

We encourage you to review this Policy periodically. Continued use of our services after the effective date of a revised Policy constitutes your acceptance of the changes, except where applicable law requires fresh consent.

Archived versions of this Policy are available upon request by emailing support@canxinnew.com.

21. Contact Us and Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or your personal information, please contact us:

We will acknowledge receipt of your inquiry within 3 business days and provide a substantive response within the timeframes required by applicable law (typically 30 days for GDPR, 45 days for CCPA, 30 days for PIPL).

If you are not satisfied with our response, you may lodge a complaint with the relevant supervisory authority in your jurisdiction as outlined in the applicable regional sections of this Policy.